CVE-2026-68955CWE-427

CVE-2026-68955

High · published September 14, 2026

CVSS v3.0
7.8
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affected installer, arbitrary code may be executed with the privileges of the user who performed the installation.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.4 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2026-09-14T11:17Z
References (2)
https://help.kobo.com/hc/en-us/articles/42294089837463-Security-Advisory-Kobo-Desktop-App-Installer · [email protected]https://jvn.jp/en/jp/JVN18593874/ · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 14 SEP 06:35Z
    The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries
    cvelistv5